5.4 Medium

CVE-2023-28670 Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's…

Description

Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Pipeline Aggregator View Plugin 1.13	earliest → 1.13	No fix stated

The 2 CVEs of Jenkins Pipeline Aggregator View Plugin →

CVE-2019-16564 Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a… Not rated

Do you use Jenkins Pipeline Aggregator View Plugin?

Track this CVE Watch Jenkins Pipeline Aggregator View Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2023-28670

Timeline

Published March 23, 2023
Last modified February 25, 2025

References

Jenkins Security Advisory 2023-03-21 www.jenkins.io

Track this CVE

CVE-2023-28670 Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's…

Description

Affected products and versions

Other CVEs of Jenkins Pipeline Aggregator View Plugin